eec00f4d413960b8bb38bf988246560a6faf507457c786cd854b53228e40d942

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 02:51

Target
eec00f4d413960b8bb38bf988246560a6faf507457c786cd854b53228e40d942.dll
Size 899KB
Sample240423-db5dlacb5t
SHA256 eec00f4d413960b8bb38bf988246560a6faf507457c786cd854b53228e40d942
MD5 895664bf6cdb5a394b5bd0f4579d0d25
SHA1 06ab5eb94b7b19c47ee6b590f371870c9a96fe4f
SHA512 c947b77dc2af863c76b1f0233882bbdf94aa58aff5f780efb9f6db5fca45a3a5af4538c9170dda8043e53586005c25a23a6805d10d093b1796ed3c67078c7a61
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXG:7wqd87VG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4748	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 4748	824	rundll32.exe	90
PID 824 wrote to memory of 4748	824	rundll32.exe	90
PID 824 wrote to memory of 4748	824	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eec00f4d413960b8bb38bf988246560a6faf507457c786cd854b53228e40d942.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eec00f4d413960b8bb38bf988246560a6faf507457c786cd854b53228e40d942.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:1892